403 Forbidden on Write Attempt with Trello Read-Only Token

Scope Enforcement vs. User Permissions

Yes, Trello returns a 403 Forbidden status for every write-type request made with a token that possesses only the read-only scope. This enforcement occurs at the API layer and is independent of the user's actual role on the target board.

The Interaction Between Scope and Admin Rights

A common point of confusion is whether administrative privileges can override token restrictions. In the Trello API architecture, token scope acts as a hard filter that precedes user permission checks. Even if the authenticating user is a board administrator with full manual control over the board, a token issued with scope=read cannot perform write operations. The API validates the token's capabilities before it evaluates whether the user has the right to perform the action on that specific resource.

Affected Endpoints

Any endpoint that modifies data—regardless of whether it is a card-level or board-level change—is blocked by the read-only scope. This includes, but is not limited to:

• Card Operations: POST /1/cards, PUT /1/cards/{id}, DELETE /1/cards/{id}
• List Operations: POST /1/lists, PUT /1/lists/{id}, DELETE /1/lists/{id}
• Board Settings: PUT /1/boards/{id} (e.g., changing the board name or visibility)
• Member Management: Adding or removing members from a board via API.

Verification Steps

To verify this behavior in your environment, you can use a simple curl command to attempt a card update. Replace the placeholders with your actual credentials:

curl -X PUT "https://api.trello.com/1/cards/{cardId}/name?value=TestUpdate&key={yourKey}&token={readOnlyToken}"

A read-only token will return a 403 Forbidden, while a token with write scope will return a 200 OK.

Diagnostic Note

If you are receiving a 401 Unauthorized instead of a 403 Forbidden, the issue is likely a malformed or expired token rather than a scope restriction. Please confirm if you are seeing 401 or 403 errors specifically.